Careers

Current Openings

Cybersecurity Internship Program

Looking to jumpstart your career in cybersecurity? See what our Internship program is all about and apply for the next enrollment.

Why Join The Security Innovation Team?

Our Passion for Application Security

Software runs the modern world, and for over a decade, we’ve been making its use safer in the most challenging environments – whether in Web or Mobile applications, IoT devices, or the cloud.

Reputation

Security Innovation has been protecting the world’s most reputable brands for almost two decades. We are well-known experts, routinely presenting at notable security conferences, releasing timely insight, and making a name for ourselves. Come make a name for yourself!

Recognition & Achievements:

Presented at RSA Conference, Blackhat, Ponemon Institute RIM Renaissance, Defcon, OWASP AppSec, and others
Gartner Cool Vendor and recurring Gartner Magic Quadrant designations for security training
High ratings for Glassdoor and Gartner Peer Insights
Apple Hall of Famers, Ponemon Institute Fellows, Microsoft MVPs, Privacy by Design Ambassadors
Reboot Leadership Influencer, Cyber Security Excellence Best Security Education Provider, InfoSecurity Grand Trophy for Global Excellence

Community Commitment

We support the local community by making security more accessible for minorities, women, and everyone. Join us in making an impact.

Security Innovation

Company Links

Services
Solutions
Resources
About Us
Careers
Blog

Contact

Phone
General: 1.877.839.7598
Sales: 1.877.839.7598 x1

Support
1.877.839.7598 x2
Email

Offices

Pune, India
516 World Trade Center – Tower 2
Kharadi, Pune, MH 411014
Phone: +91 820 840 1411
Email: India Sales

Seattle, WA
1511 3rd Ave #808
Seattle, WA 98101

DOWNLOAD

PROJECT
Motorcycle Ignition Control System (ICS) Reverse Engineering

CUSTOMER CONCERNS
The motorcycle’s ignition control system (ICS) governs the spark timing to ignite the engine’s fuel-air mixture. The client needed to understand if the system could be reverse-engineered to tweak the performance of the motorcycle, such as increasing horsepower by adjusting spark timing or altering the rev limits.

THE MISSION: WHY WE HACKED IT
The ignition control system on this motorcycle was being investigated for potential performance tuning. The system was embedded within a sealed box and controlled the timing of the ignition sparks via a microcontroller. The client wanted to reverse engineer the system to modify the engine’s performance. The goal was to learn more about the ICS and determine if it could be reprogrammed to boost performance without compromising reliability.

THE BREAKDOWN: WHAT WE FOUND
We approached the reverse engineering process by:

Hardware Deconstruction: Attempted to physically access and probe the circuit board within the sealed ignition control system to understand how it operated.
Microcontroller Identification: Identified the microcontroller governing the system, despite challenges caused by the protective sealing, and searched for debugging or reprogramming interfaces.

DURING TESTING WE UNCOVERED SEVERAL CRITICAL ISSUES:

Sealant Protection Mechanism: The system was heavily sealed with materials designed to deter reverse engineering, which led to some damage when trying to access the board.
No Debug Interface: Despite thorough testing of potential interfaces, there was no straightforward method to reprogram the microcontroller or extract the firmware.
Limited Firmware Accessibility: The microcontroller utilized mask ROM, meaning the firmware was hardcoded and could not be extracted without advanced techniques like decapping.

BY REMEDIATING THESE ISSUES, THE CLIENT WAS ABLE TO:

Pivot the approach to Black Box Testing: By simulating the inputs and measuring the outputs (e.g., camshaft position and throttle), the client successfully inferred the ignition timing algorithms.
Build a Custom Simulator: The client created a custom microcontroller system to mimic the ICS behavior and explore performance tuning possibilities.

As a result, the client gained a deeper understanding of how the ICS controlled the engine’s performance and could start building a new, programmable system to improve power and efficiency. While direct reprogramming wasn’t possible, the black-box approach provided valuable insights into how to modify the ignition timing for enhanced performance.

DOWNLOAD

PROJECT
Sprinkler Controller with BLE Support and Mobile Apps

CUSTOMER CONCERNS
With the addition of Bluetooth Low Energy (BLE) support, the client’s updated controllers were designed to allow users to control the system remotely via mobile applications. The client needed to ensure that this new connectivity didn’t introduce vulnerabilities, which could potentially expose customer devices to unauthorized access.

THE MISSION: WHY WE HACKED IT
The client was integrating BLE into their next-generation IoT sprinkler controller. BLE is a common technology in IoT devices, but it’s also a frequent target for hackers due to its security misconfigurations. The client needed assurance that the new connectivity didn’t open up paths for attackers to compromise devices, manipulate sprinkler settings, or gain unauthorized access to user networks. Our goal was to pinpoint any security flaws early, ensuring that customers’ homes and gardens weren’t at risk from cyber threats.

THE BREAKDOWN: WHAT WE FOUND
We tackled the security review using two methodologies:

OWASP Top 10 for Mobile Applications: Assessed the mobile app for vulnerabilities like insecure data storage, insufficient transport layer protection, and improper authentication.
IoT Testing for BLE Configuration: Examined how BLE was implemented and configured to ensure there were no common misconfigurations like lack of authentication or unencrypted data transmission.

DURING TESTING WE UNCOVERED SEVERAL CRITICAL ISSUES:

Design Flaws in the BLE Pairing Process: Weak pairing mechanisms made it easier for potential attackers to eavesdrop or interfere.
Vulnerabilities in Mobile App Data Handling: Sensitive data was being stored without adequate encryption, making it possible for an attacker with device access to extract and misuse it.
Exposed Device Commands: Several BLE commands used to control the sprinkler settings were not properly secured, leaving room for unauthorized manipulation.

BY REMEDIATING THESE ISSUES, THE CLIENT WAS ABLE TO:
By remediating these issues, the client was able to:

Secure the BLE pairing process, ensuring that only legitimate users could control the device.
Implement secure storage and transmission methods for sensitive information within the mobile apps.
Lock down device commands, reducing the likelihood of malicious tampering.

As a result, the client’s BLE-supported sprinkler controllers were not only more secure, but they also provided peace of mind to end-users, who could trust that their smart systems were robust against potential cyber threats. This proactive security testing allowed the client to go to market with confidence, turning a potential risk into a competitive advantage.